How does Datto RMM determine if a reboot is needed?

The following scenarios in Datto RMM determine that a reboot is needed:

  • Reboots are required after a Patch Management policy is run.
  • The Reboot Required status appears in the web interface.

Patch mechanism

During a Patch Management policy run, if patches that require a reboot are installed, the reboot.flag file will be created and delete the following registry key if the option to prevent reboot is selected:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

The file reboot.flag will be generated in the path C:\ProgramData\CentraStage. This is what tells the Agent that a reboot from patching is needed and will be picked up on audit.

NOTE  This registry key is not used to determine if patches that require reboot were installed.

NOTE   The mechanism described in this section is used to determine if the reboot reminder toaster pop-up notification will be displayed. The mechanism described in the next section is not tied to the toaster pop-up notification.

Audit mechanism

This file is created during an audit of the device (as will occur following a patching window). The following registry keys will be checked, and if any indicate a reboot is needed, this will be reflected on the platform for the device. In addition to checking the registry keys, Datto RMM also checks if the reboot.flag file exists.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired

HKLM\SOFTWARE\Microsoft\Updates\UpdateExeVolatile

HKLM\SOFTWARE\Wow6432Node\Microsoft\Updates\UpdateExeVolatile

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending

Audit after reboot

If a reboot is found to be needed during audit or during the Patch Management policy, a field will be updated in user.config.

A directory within C:\Windows\System32\config\systemprofile\AppData\Local\CentraStage will contain the user.config file.

Datto RMM uses the folder with the name that corresponds with the latest Agent version. Older folders can be ignored.

If this property has the value of True, an audit will occur when the device reboots. Therefore, the expected behavior is that if a device has the reboot flag set, it should quickly be updated on the platform after a reboot, as an audit should occur following the next reboot.

References

  • Patch Mechanism: CentraStage.Cag.Core.Agent.PatchManagement.Patcher in Core.dll
    • Method: Worker()
    • Method: PreventReboot()
  • Reboot.flag mechanism: CentraStage.Cag.Core.Util.FileUtil in Core.dll
  • Audit Mechanism: WindowsAgent.Audit in WindowsAgent.dll
    • Method: IsRebootNeded()
  • DoAuditAfterReboot flag check: CentraStage.Cag.Core.Agent.AgentEngine in Core.dll
    • Method: EveryMinute()
  • DoAuditAfterReboot gets set in the following two places in Core.dll:
    • CentraStage.Cag.Core.Agent.Audit.AuditHandler // Method: DoAudit()
    • CentraStage.Cag.Core.Agent.PatchManagement.Patcher // Method: Worker()